--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -158,6 +158,8 @@
 		return (error);
 	if (new_val > 0 && ((new_val > 16 * PAGE_SIZE) || !powerof2(new_val)))
 		return (EINVAL);
+	if (new_val < 0 && (unsigned)-new_val > 16 * PAGE_SIZE)
+		return (EINVAL);	/* static gap must stay bounded too */
 	stackgap_random = new_val;
 
 	return(0);